Skip to content

Before you begin

Prepare these items before opening the guided setup. Use Docs authority & product state for the binding release-state index that governs every capability named here.

Choose an authorized operator

An authorized developer, Engineer, or Admin can complete the engineering active-use path. Use the least-privileged role that can perform each task.

Task Required role or permission
Create the tenant and configure IdP federation Admin with tenant and identity settings access
Confirm product entitlement Admin with subscription settings access
Register an evidence source Engineer or Admin with connector settings access
Create cloud-side read-only resources Cloud administrator for setup only
Deploy and run readiness probes Engineer with deployment access

The setup identity may create roles and assignments. Venturi’s standing cloud identity remains read-only.

Install local tools

Tool Version Check
Terraform 1.5 or later terraform version
Cloud CLI Current supported release aws --version, gcloud version, or az version
git Any supported release git --version

Authenticate to the exact account, project, or subscription you intend to connect:

Bash
aws sts get-caller-identity

The setup principal needs permission to create an IAM role and its policy. The generated role uses an external-ID condition and a 15-minute session duration.

Bash
gcloud auth application-default login
gcloud config set project <project_id>

The setup principal needs roles/iam.workloadIdentityPoolAdmin and service account creation authority. Workload Identity Federation is the default; do not create an exported service-account key.

Bash
az login
az account set --subscription <subscription_id>

The setup principal needs application-registration permission plus Owner or User Access Administrator on the subscription. A CI identity can use Application.ReadWrite.OwnedBy plus the same role-assignment authority.

Gather customer-owned values

  • AWS: CUR bucket, prefix, region, and whether Bedrock inventory is needed.
  • Google Cloud: project ID, project number, and billing-export dataset.
  • Azure: tenant ID, subscription ID, and whether Azure OpenAI telemetry uses APIM or Event Hubs.
  • Provider API path: customer-provided read-only provider-account credentials.

Venturi tenant, connector, federation, and external-ID setup artifacts are generated in-product. Customer-provided provider-account credentials are entered in-product. Credentials remain tenant-local and are validated for read-only access. No Venturi-human response or emailed setup value is required.

Success evidence

  • The guided setup opens for the authorized operator.
  • The selected tenant and entitlement are visible.
  • Local tool and cloud identity checks succeed.
  • The operator can continue to Organization setup.

Recovery

Correct the local tool, cloud account, or role shown by the failed preflight and rerun it. If access cannot be restored in-product, use Support as an optional escalation path.

Continue to the quickstart